Attachment #191674 for bug #270305





	return ret;
	}

int
pqueue_size(pqueue_s *pq)
{
	pitem *item = pq->items;
	int count = 0;
	
	while(item != NULL)
	{
		count++;
		item = item->next;
	}
	return count;
}

Lines 91-95 Link Here

(-)pqueue.h (+1 lines)
91	pitem pqueue_next(piterator iter);	91	pitem pqueue_next(piterator iter);
92		92
93	void pqueue_print(pqueue pq);	93	void pqueue_print(pqueue pq);
		94	int pqueue_size(pqueue pq);
94		95
95	#endif /* ! HEADER_PQUEUE_H */	96	#endif /* ! HEADER_PQUEUE_H */

Lines 167-172 Link Here

(-)d1_pkt.c (+4 lines)
167	DTLS1_RECORD_DATA *rdata;	167	DTLS1_RECORD_DATA *rdata;
168	pitem *item;	168	pitem *item;
169		169
		170	/* Limit the size of the queue to prevent DOS attacks */
		171	if (pqueue_size(queue->q) >= 100)
		172	return 0;
		173
170	rdata = OPENSSL_malloc(sizeof(DTLS1_RECORD_DATA));	174	rdata = OPENSSL_malloc(sizeof(DTLS1_RECORD_DATA));
171	item = pitem_new(priority, rdata);	175	item = pitem_new(priority, rdata);
172	if (rdata == NULL \|\| item == NULL)	176	if (rdata == NULL \|\| item == NULL)

Return to bug 270305

Lines 234-236 Link Here

(-)pqueue.c (+14 lines)
234		234
235	return ret;	235	return ret;
236	}	236	}
		237
		238	int
		239	pqueue_size(pqueue_s *pq)
		240	{
		241	pitem *item = pq->items;
		242	int count = 0;
		243
		244	while(item != NULL)
		245	{
		246	count++;
		247	item = item->next;
		248	}
		249	return count;
		250	}